{"action":"created","issue":{"url":"https://api.github.com/repos/ImageMagick/ImageMagick/issues/546","repository_url":"https://api.github.com/repos/ImageMagick/ImageMagick","labels_url":"https://api.github.com/repos/ImageMagick/ImageMagick/issues/546/labels{/name}","comments_url":"https://api.github.com/repos/ImageMagick/ImageMagick/issues/546/comments","events_url":"https://api.github.com/repos/ImageMagick/ImageMagick/issues/546/events","html_url":"https://github.com/ImageMagick/ImageMagick/issues/546","id":240885913,"number":546,"title":"memory exhaustion in ReadMPCImage","user":{"login":"bestshow","id":5211744,"avatar_url":"https://avatars2.githubusercontent.com/u/5211744?v=3","gravatar_id":"","url":"https://api.github.com/users/bestshow","html_url":"https://github.com/bestshow","followers_url":"https://api.github.com/users/bestshow/followers","following_url":"https://api.github.com/users/bestshow/following{/other_user}","gists_url":"https://api.github.com/users/bestshow/gists{/gist_id}","starred_url":"https://api.github.com/users/bestshow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bestshow/subscriptions","organizations_url":"https://api.github.com/users/bestshow/orgs","repos_url":"https://api.github.com/users/bestshow/repos","events_url":"https://api.github.com/users/bestshow/events{/privacy}","received_events_url":"https://api.github.com/users/bestshow/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-07-06T08:47:57Z","updated_at":"2017-07-06T10:24:36Z","closed_at":null,"body":"Version: ImageMagick 7.0.6-1 Q16 x86_64\r\n`#./magick identify $FILE`\r\nWhen identify MPC file , imagemagick will allocate memory to store the data, here is the critical code:\r\n(Mpc.c , in function ReadMPCImage)\r\n```\r\n image->colormap=(PixelInfo *) AcquireQuantumMemory(image->colors+1,  //856\r\n          sizeof(*image->colormap));\r\n```\r\nThe “image->colors\" can be obtained from local value “options” as follow, and the options is controlled by image , in other words the “image->colors\" can be read from input file.\r\n`image->colors=StringToUnsignedLong(options); //402`\r\n\r\nThe function StringToUnsignedLong convert string to unsigned long type, but the return value was not checked.\r\nHere is my policy.xml to limit memory usage,but 256MB limit can be bypassed.\r\n```\r\n...\r\n<policy domain=\"resource\" name=\"area\" value=\"100MP\"/>\r\n<policy domain=\"resource\" name=\"memory\" value=\"256MiB”/>\r\n...\r\n```\r\ntestcase: https://github.com/bestshow/p0cs/blob/master/memory_exhaustion_in_ReadMPCImage\r\nCredit ADLab of Venustech"},"comment":{"url":"https://api.github.com/repos/ImageMagick/ImageMagick/issues/comments/313358129","html_url":"https://github.com/ImageMagick/ImageMagick/issues/546#issuecomment-313358129","issue_url":"https://api.github.com/repos/ImageMagick/ImageMagick/issues/546","id":313358129,"user":{"login":"mikayla-grace","id":10504993,"avatar_url":"https://avatars1.githubusercontent.com/u/10504993?v=3","gravatar_id":"","url":"https://api.github.com/users/mikayla-grace","html_url":"https://github.com/mikayla-grace","followers_url":"https://api.github.com/users/mikayla-grace/followers","following_url":"https://api.github.com/users/mikayla-grace/following{/other_user}","gists_url":"https://api.github.com/users/mikayla-grace/gists{/gist_id}","starred_url":"https://api.github.com/users/mikayla-grace/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikayla-grace/subscriptions","organizations_url":"https://api.github.com/users/mikayla-grace/orgs","repos_url":"https://api.github.com/users/mikayla-grace/repos","events_url":"https://api.github.com/users/mikayla-grace/events{/privacy}","received_events_url":"https://api.github.com/users/mikayla-grace/received_events","type":"User","site_admin":false},"created_at":"2017-07-06T10:24:36Z","updated_at":"2017-07-06T10:24:36Z","body":"Thanks for the problem report.  We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today.  The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow. \r\n"}}
{"actor":{"display_login":"mikayla-grace"}}